CVE-2026-64454
Received Received - Intake

USB Gadget Disconnect in Linux Kernel

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: run gadget disconnect from sleepable suspend context dwc3_gadget_suspend() takes dwc->lock with IRQs disabled and then calls dwc3_disconnect_gadget(). For async callbacks that helper only uses plain spin_unlock()/spin_lock(), so the gadget ->disconnect() callback still runs with IRQs disabled and any sleepable callback trips Lockdep. This issue was found by our static analysis tool and then manually reviewed against the current tree. The grounded PoC kept the dwc3_gadget_suspend() -> dwc3_disconnect_gadget() -> gadget_driver->disconnect() chain, and Lockdep reported: BUG: sleeping function called from invalid context gadget_disconnect+0x21/0x39 [vuln_msv] dwc3_gadget_suspend.constprop.0+0x2b/0x42 [vuln_msv] Keep the disconnect callback selection in one common helper, but add a sleepable suspend-side wrapper which snapshots the callback under dwc->lock and then runs it after spin_unlock_irqrestore(). The regular event path still uses the existing spin_unlock()/spin_lock() window.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-08-14
AI Q&A
2026-07-25
EPSS Evaluated
2026-08-13
NVD
CVE-2026-64454
EUVD
EUVD-2026-48798

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the USB gadget subsystem. The issue occurs when the dwc3_gadget_suspend() function locks a spinlock with interrupts disabled and then calls dwc3_disconnect_gadget(), which triggers a gadget driver's disconnect callback. This callback may sleep, violating the non-sleepable context enforced by the locked spinlock with interrupts disabled.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB gadget subsystem and involves a locking issue during suspend operations. Detection requires checking kernel logs for Lockdep warnings or analyzing the dwc3 driver's behavior during suspend/resume cycles.

Impact Analysis

This vulnerability could cause system instability or crashes if a gadget driver's disconnect callback attempts to sleep while holding a non-sleepable lock. It may lead to kernel panics or unexpected behavior in systems using USB gadget functionality, particularly during suspend/resume operations.

Mitigation Strategies

Apply the latest Linux kernel patches that address this vulnerability. Monitor vendor advisories for updates specific to your distribution. Ensure your kernel version is updated to one that includes the fix for the dwc3 gadget disconnect issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64454. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart